Rooting the Cube U30GT rk3066 android tablet

I just bought a Cube U30GT Android tablet, based on the Rockchip RK3066 ARM chipset. Here are the instructions to root it under Linux.

The U30GT is a nice tablet. It only cost me about 180 euros (€150 tablet + shipping, €30 VAT or “BTW” as it’s called in the Netherlands). Value for money!
Now the reason I bought this very tablet is that it’s specs are nearing older Intel “Atom” chips, which could mean that this €180 tablet is actually a €350 laptop – minus keyboard. So the first thing to do here was to root the thing.
Here is the step-by-step instructions for rooting this tablet under Linux. Usual disclaimers apply: do not try this at home; if you break your tablet, it’s broken; no guarantees. It worked for me, quite easily, but it may not work for you.

2012-04-12 I received some reports of non-bootable machines, please read the update.
2014-06-16 Updated update: unbrick your Neo X7 and most likely unbrick and/or flash other RK3XYZ machines. The warning no longer applies. Also, see below.

  1. get the rkflashtool source code from
  2. Add USB identification for the RK3066 chip, 0x2207, 0x300a. Your code will now look like:
    if (!(h = libusb_open_device_with_vid_pid(c, 0x2207, 0x290a)))
    if (!(h = libusb_open_device_with_vid_pid(c, 0x2207, 0x281a)))
    if (!(h = libusb_open_device_with_vid_pid(c, 0x2207, 0x300a)))
       fatal("cannot open device\n");
  3. Install libusb-1.0-0-dev and compile:
    sudo apt-get install libusb-1.0-0-dev
    gcc -o rkflashtool rkflashtool.c -lusb-1.0 -O2 -W -Wall -s
  4. Turn off your U30GT. Insert the USB cable. Hold the “volume +” button, then push the “power” button for about 5 seconds. Afterwards, “lsusb” should show the U30GT identification, something like Bus 001 Device 007: ID 2207:300a
  5. Read the partition information for your U30GT:
    sudo ./rkflashtool r 0x0000 0x2000 > /tmp/parm
  6. in /tmp/parm you will find something like:
    CMDLINE: console=ttyFIQ0 androidboot.console=ttyFIQ0 init=/init initrd=0x62000000
    ,0x00800000 mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00004000@0x00004000

    It’s the “(system)” partition that we’re after. In this case: 0x00100000@0x00354000
  7. Use rkflashtool again, with our newly found parameters:
    sudo ./rkflashtool r 0x00354000 0x00100000 > /tmp/system.loop
  8. Save this file in a safe place, it is your original!
  9. From hereon, it’s rather trivial. Mount the image, change whatever you like and write it back. Something like:
    sudo mount -o loop /tmp/system.loop /mnt
    cd /mnt/app
    cp ~/Download/Superuser.apk /mnt/app
    cp ~/Download/su.arm /mnt/bin/su

    There are lots of other things that you may want to do, like removing buyu.apk CCCCACDE.apk com.chaozh.iReaderFree_145459.apk cube.0.3.0_v2963.apk es.apk Galaxy4.apk hd.apk HoloSpiralWallpaper.apk MagicSmokeWallpapers.apk qq_hd_1.7.0.apk uc.apk, change the and mess around freely. You did copy your image in step 8, didn’t you?
  10. Write back and reboot:

    sudo umount /mnt
    sudo ./rkflashtool w 0x00354000 0x00100000 < /tmp/system.loop
    I guess you need to write back with sudo ./upgrade_tool di -s /tmp/system.loop, see here for more information about upgrade_tool; but I’ll try to find a spare moment to write a separate blog post about it. Then reboot.
    sudo ./rkflashtool b

That’s all, folks!

13 Replies to “Rooting the Cube U30GT rk3066 android tablet”

  1. Hi,
    I have an android device UG802 based on the same RK3066 chip. I was trying to use the method you described above for reading the internal flash of the device, but I failed.
    I’m able to switch the device into the service mode, so I can see it in Linux when using lsusb (Bus 002 Device 008: ID 2207:300a). I’ve downloaded, modified (enabled the 2207:300a device)
    and compiled the rkflashtool. Now, the problem I have is the rkflashtool fails when using bulk transfers. I can see a lot of messages like this on the console:
    libusb:warning [do_sync_bulk_transfer] unrecognised status code 1

    When I print the number of transfered bytes and return code of the libusb_bulk_transfer is can see this:
    rkflashtool: info: transfered = 0
    rkflashtool: info: ret=-99

    Interestingly the libusb_open_device_with_vid_pid(…) and libusb_claim_interface(h, 0) fuction call (in the rkflashrool) returned no error so the device can be accessed by the libusb…

    So the question is: did you encounter similar problem? If not, what Linux distibution do you use and which version. I tried ubuntu 12.04, 11.10 and 10.04, and I got the same bulk transfer errors. I also tried to connect to a usb hub or directly to my laptop, but it didn’t help.

  2. Unfortunately, that’s exactly what I get. I, too, have a UG802 and I also tried to use rkflashtool for it (you need to shorten two pins on the board, then 2207:300a appears). But all I get is the same “unrecognised status code 1”. As it won’t even transfer a single byte, (“transferred = 0”), I also tried to read first, but that doesn’t do anything. I simply can’t get it to work and I don’t know why. So for my Cube U30GT it works, for my UG802 it doesn’t.

  3. Thanks for the info. That means my computer and libusb are fine. I tried to use the old libusb-0.1.12 (similar rkflash tool using old libusb from here:, which doesn’t return errors during bulk transfers, but there were no data in the input/output buffer.

  4. Some progress on UG802. I switched to the recovery mode via android terminal:
    reboot bootloader
    (requires rooted UG802). This also enables the USB device 2207:300a without shortening the pins. Then I used the Ithamar’s rkutils (see link in my previous post) to read the flash and I got this result:
    ATAG: 0x60000800
    MACHINE: 3066
    CHECK_MASK: 0x80
    KERNEL_IMG: 0x60408000
    #RECOVER_KEY: 1,1,0,20,0
    CMDLINE: console=ttyFIQ0 androidboot.console=ttyFIQ0 init=/init initrd=0x62000000,0x00800000 mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00004000@0x00004000(kernel),0x00008000@0x00008000(boot),0x00008000@0x00010000(recovery),0x000C0000@0x00018000(backup),0x00040000@0x000D8000(cache),0x00100000@0x00118000(userdata),0x00002000@0x00218000(kpanic),0x000A0000@0x0021A000(system),-@0x0033A000(user)

  5. heya there, found this very usefull.I dont own this device yet, but in a few days with hope. While I understand most of the stuff written here, I’m quite a beginner at rooting android device but I did it sucessfully two time on two different device (woot =p).
    My question is can is use the same CWM-superSU-v0.92 software I used already ? (su.arm and superuser.apk)

    as you see my trouble isnt a big one =)

  6. Thanks a lot for this guide!

    I can confirm that reading the flash according to these instructions works on a Fedora 15 Linux box. The tablet is a TreckStor Ventos 9.7 (RK3066).

  7. I follow this guide, make backup, make changes, write back, superuser app show up however i still haven’t root permissions so i write backup to device and… now i am stuck on boot, on first, non-moving screen. I have second exactly same tablet to read data, but when i read system and write it to mine tablet, problem still occur. Help!

  8. I have a Nextway F9 tablet, also based on RK3066. I have succeeded in reading the ROM, but when I flash it back, the tablet doesn’t boot, it’s just stuck on the first splash (the non-moving one), even if I flash the original thing back to the same offset and everything. Even what I read back from the tablet is the same as the one I read before flashing. Can someone please advise me where to look for errors or what could possibly have gone wrong?
    I can experiment with it freely as the rk batch tool still flashes everything back to normal.

Leave a Reply

Your email address will not be published. Required fields are marked *